IR 05000317/2015009
| ML15147A354 | |
| Person / Time | |
|---|---|
| Site: | Calvert Cliffs  |
| Issue date: | 05/27/2015 |
| From: | Mel Gray Engineering Region 1 Branch 1 |
| To: | George Gellrich Exelon Generation Co |
| References | |
| IR 2015009 | |
| Download: ML15147A354 (28) | |
Text
May 27, 2015
SUBJECT:
CALVERT CLIFFS NUCLEAR POWER PLANT UNITS 1 AND 2 - NRC SPECIAL INSPECTION REPORT 05000317/2015009 AND 05000318/2015009
Dear Mr. Gellrich:
On April 17, 2015, the U.S. Nuclear Regulatory Commission (NRC) completed a Special Inspection Team (SIT) review of the April 7, 2015, dual-unit reactor trip at your Calvert Cliffs Nuclear Power Plant (CCNPP), Units 1 and 2. The SIT Charter (Attachment 1 of the enclosed report) provides the basis and details concerning the scope of the inspection. The enclosed report documents the inspection teams activities and observations conducted in accordance with the SIT Charter. The team leader discussed the results of this inspection on April 17, 2015, with Mr. Mark Flaherty, Plant Manager, and other members of your staff.
The special inspection was conducted in response to the dual unit trip that occurred on April 7, 2015, resulting from a 500 kilovolt (kV) offsite grid disturbance. Plant equipment responded as designed to isolate the 4 kV electrical safety buses for the two units from offsite power sources.
However, the plant response was complicated because of a subsequent failure of the 2B emergency diesel generator (EDG) to start and re-energize its associated 4 kV safety bus, and the failure of the 2A EDG sequencer to automatically sequence safety related loads onto its associated 4 kV safety bus. The enclosed chronology (Attachment 2 of the report) provides additional details on the sequence of events that the team developed during the inspection. The NRCs initial evaluation of this event satisfied the criteria in NRC Inspection Manual Chapter 0309, Reactive Inspection Decision Basis for Reactors, for conducting a special inspection.
The inspectors examined activities conducted under your license as they relate to safety and compliance with Commission rules and regulations and with conditions of your license. The inspectors reviewed selected procedures and records, observed activities, conducted in-plant equipment inspections, and interviewed personnel. In particular, the inspection team discussed the dual unit trip with operators involved in the response. The team reviewed technical evaluations completed by Exelon staff to identify the causes of the dual unit reactor trip. The team further reviewed the results of equipment tests and evaluations that identified specific electrical circuit subcomponents that failed and caused the emergency diesel generator and sequencer equipment problems. Finally, the inspectors reviewed actions taken to repair these components and ensure redundant equipment was not similarly affected. No findings were identified during this inspection. The team concluded that, overall, organizational and operator response to the dual unit reactor trip was appropriate and in accordance with CCNPP procedures and training. The team further determined that Exelon staff completed appropriate interim corrective actions to address the causes of the dual-unit trip and restored equipment in accordance with the plants design and applicable regulatory requirements.
The SIT Charter excluded from review those root causes or other analyses not yet complete at the time of the inspection. While the affected equipment was repaired, the team noted that detailed casual evaluations related to the electrical circuit subcomponent failures were not complete at the time of the inspection. We plan to review the results of your evaluations and longer term corrective actions as part of future baseline inspections.
In accordance with Title 10 of the Code of Federal Regulations (CFR) 2.390 of the NRCs Rules of Practice, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records component of the NRCs Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC website at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).
Sincerely,
/RA/
Mel Gray, Branch Chief Engineering Branch 1 Division of Reactor Safety Docket Nos. 50-317 and 50-318 License Nos. DPR-53 and DPR-69
Enclosure:
Inspection Report 05000317/2015009 and 05000318/2015009 w/Attachments 1, 2, and 3
REGION I==
Docket Nos.: 50-317 and 50-318 License Nos.: DPR-53 and DPR-69 Report Nos.: 05000317/2015009 and 05000318/2015009 Licensee: Calvert Cliffs Nuclear Power Plant, LLC Exelon Generation Company, LLC Facility: Calvert Cliffs Nuclear Power Plant, Units 1 and 2 Location: Lusby, Maryland Dates: April 07 through 17, 2015 Inspectors: Manan P. Patel, Operations Engineer, Operations Branch, Division of Reactor Safety (DRS) (Team Leader)
Roy L. Fuhrmeister, Senior Reactor Inspector, Engineering Branch 3, DRS Tom Hedigan, Operations Engineer, Operations Branch, DRS W. Cook, Senior Reactor Analyst Approved by: Mel Gray, Branch Chief Engineering Branch 1 Division of Reactor Safety i Enclosure
SUMMARY OF FINDINGS
IR 05000317/2015009, 05000318/2015009; 04/13/2015 - 04/17/2015; Calvert Cliffs Nuclear
Power Plant (CCNPP), Units 1 and 2; Special Inspection to review the April 7, 2015, Dual-Unit Reactor Trip; Inspection Procedure 93812, Special Inspection.
A three-person NRC team, comprised of regional inspectors and a regional senior reactor analyst conducted this Special Inspection, identifying no findings of significance. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 5.
iii
REPORT DETAILS
1. INTRODUCTION
1. Background and Event Description
In accordance with the Special Inspection Team (SIT) charter (Attachment 1), team members (the team) conducted a detailed review of the April 7, 2015, dual unit trip with complications at Calvert Cliffs Nuclear Power Plant (CCNPP) including equipment and operator response. The team gathered information from the plant process computer (PPC) alarm printouts, interviewed station personnel, performed physical walkdowns of plant equipment, and reviewed procedures, maintenance records, and various technical documents to develop a detailed timeline of the event (Attachment 2). The following represents an abbreviated summary of the significant automatic plant and operator responses:
On April 7, 2015, at 12:39 p.m., CCNPP Unit 1 and Unit 2 reactors automatically tripped due to the failure of a transmission line in Southern Maryland. The failure of the transmission line caused a grid disturbance, where both 500 kV offsite power sources for CCNPP decreased approximately 11 percent in voltage from 525 kV to 465 kV. This voltage dip was sensed by the Transient Undervoltage Relay (TUR) for the safety related 4 kV Emergency Busses 11 and 14 (Unit 1) and Busses 21 and 24 (Unit 2),
which actuated, resulting in all four emergency bus feeder breakers to trip open and causing all four emergency diesel generators (EDG) to autostart.
The Unit 1 Turbine Generator lost field excitation (loss of Motor Control Center (MCC)101AT and 101BT) causing a turbine trip on loss of load and subsequent reactor trip.
The Unit 1 Steam Generator Feed Pumps (SGFPs) tripped and Auxiliary Feedwater (AFW) was manually actuated. Regarding Unit 2, the grid disturbance caused the 2Y09/2Y10, 120 VAC power supplies to lose power. This resulted in loss of power to the turbine control system and caused the turbine valves to close. A loss of load condition resulted and the Unit 2 reactor tripped.
The plant response to the Unit 2 reactor trip was complicated by the 2B EDG failing to provide power to the 24 4 kV bus. This resulted in a loss of the 22 and 23 Salt Water (SW) pumps, which were aligned to the 24 4 kV bus. It was also determined the Unit 2 A sequencer did not perform its safety function to sequence electrical loads on its associated safety bus 21. The sequencer failure caused the loss of 21 salt water pump, as well as the loss of 21 Instrument Air (IA) Compressor. The combination of the loss of the 24 kV bus and the failure of the A sequencer resulted in a complete loss of salt water cooling for 12 minutes until operators manually started the 21 salt water pump.
Also, the SGFPs tripped due to loss of power to the digital ovation system, which caused all of the feed regulating valves to drive shut and a subsequent Auxiliary Feedwater Actuation Signal (AFAS).
The non-vital busses were less impacted by the electrical transient and all of the reactor coolant pumps continued to operate. Four of twelve circulating water pumps tripped on undervoltage; however, sufficient circulating water flow remained to maintain condenser vacuum and the normal heat sink for reactor decay heat removal for both units.
2. SPECIAL INSPECTION AREAS
2.1 Event Timeline
a. Inspection Scope
The team generated a timeline of the event including the grid disturbance, under voltage protection relay actuations, equipment failures, and major operator actions. The timeline is enclosed in Attachment 2 of this inspection report.
b. Findings
No findings were identified.
2.2 Equipment Response to the Event 4 kV Under Voltage Protection Scheme
a. Inspection Scope
The team reviewed the design, settings, and response of the 4.16 kV bus undervoltage protection relays. The team reviewed the event timeline, post-trip review packages, operator logs, sequence of events recorder printouts and alarm recorder printouts to determine whether the undervoltage relays operated as designed. The team also reviewed the time history of voltage on the 500 kV busses for the time of the event.
b. Findings and Observations
No findings were identified.
Each 4.16 kV emergency bus is equipped with two sets of two undervoltage relays for a total of four relays per bus. Each of the four redundant and independent relays has three sensing elements. The relays are designed to provide two-out-of-four logic for undervoltage trips.
The lowest trip setting is the Loss of Voltage Relay (LOV) set at 59 percent of nominal voltage. This trip is intended to detect a complete loss of voltage and actuates with no time delay. The second level, the TUR is set at 89 percent of nominal voltage and trips with a 6 second time delay. This level of protection ensures that the offsite power system provides a minimum of 75 percent of nominal voltage at the motor terminals to ensure starting of safety-related loads during accident conditions. The third level of protection, Steady State Undervoltage Relay (SUR), is set at 94 percent, and trips with a 99 second time delay. This level of protection ensures 90 percent nominal voltage is available at the motor terminals for starting safety-related loads. All trips have a further two second time delay due to logic and relays in the Engineered Safety Features Actuation System (ESFAS). Upon actuation, the relays disconnect the 4.16 kV bus from offsite power, and start the associated diesel generator.
The TUR setting corresponds to a voltage of 455 kV on the 500 kV busses. During the April 7, 2015, grid disturbance, the 500 kV bus voltage dipped below 455 kV at 12:39:31.
The load tap changers on the 13.8 kV regulating transformers were not designed to compensate for the rapid voltage drop at the 500 kV busses (~100 kV in 7 seconds) and the 4.16 kV busses therefore experienced a voltage dip. The 4.16 kV vital busses separated from the offsite feeds approximately 8 seconds later.
The team determined that the TUR functioned as designed in response to the degraded offsite grid conditions.
Diesel Generators and Sequencers Background When the TURs disconnected the 4.16 kV emergency busses from the offsite sources, the four safety related diesel generators received start signals. Regarding CCNPP Unit 1, the 1A and 1B diesel generators started normally, and energized their respective emergency busses. Loads controlled by the shutdown sequencers properly started and ran. After the diesel generators re-energized their associated emergency busses, loads powered from the busses were sequenced onto the associated bus in the proper order.
The sequenced start helps ensure generator voltage and frequency recover after each step in the sequence. The load sequence is controlled by one of two sequencers located in the ESFAS. One sequencer controls loads needed to respond to a Loss of Coolant Incident (LOCI) Sequencer. The other sequencer controls those loads needed for an orderly shutdown of the unit (Shutdown Sequencer). The sequencers are designed and constructed to provide load steps at 5 second intervals.
Regarding CCNPP Unit 2, the 2A diesel generator started and energized its associated emergency bus, but loads controlled by the sequencer did not start as expected. The 2B diesel generator started, but did not energize its associated emergency bus, and subsequently tripped approximately 11 seconds after the start signal. Control Room operators manually started the 0C (Station Blackout) diesel generator.
Failure of the 2B Emergency Diesel Generator to Load Bus 24
a. Inspection Scope
The team reviewed the printouts from the sequence of events recorder, alarm recorder, and the post-trip review packages to determine whether the 2B EDG received a start signal as designed. The team reviewed the maintenance and testing history of the 2B EDG to determine when the EDG last successfully ran, whether maintenance since the last successful start could have prevented an engine start, and when associated instrumentation was last calibrated.
b. Findings and Observations
No findings were identified.
The team determined that the 2B EDG was last successfully run on March 18, 2015.
The speed switch was last calibrated successfully on December 10, 2012. The preventive maintenance schedule called for replacement of the speed switch on a 10 year interval and calibration on a 4 year interval.
In response to the signals from the TUR, 4.16 kV Bus 24 separated from offsite power at 12:39:39, and the 2B EDG received a start signal. Approximately 11 seconds later, 2B EDG received a trip signal. Trouble shooting by Exelon staff determined the trip signal was initiated by the Start Failure Relay in the diesel generator control system.
This determination was based on a review of the diesel generator control schematic diagram and observation of annunciator windows and relay flags at the diesel generator control cabinet. The Start Failure Relay is a 10 second time relay which prevents excessive starting attempts in the event the engine does not start. The Start Failure Relay is interrupted by either a contact on the 250 revolutions per minute (RPM) speed switch or a pressure switch monitoring engine bearing oil pressure.
In March, 2007, a modification was performed on the 2B diesel generator to replace the mechanical speed switch with a new electronic speed switch, Model ESSB-2AT. The input to the speed switch comes from a proximity probe located at the bull gear used to bar the engine over during maintenance. As each tooth on the gear passes the probe, a pulse is generated by the probe. The frequency of the pulses is proportional to the speed of the engine. The speed switch has 3 outputs: a low speed trip set at 250 RPM, a high speed trip set at 810 RPM, and a tachometer drive signal for local speed indication.
Troubleshooting of the 2B diesel generator included calibration checks of the bearing lubricating oil pressure switch and the engine speed switch. The oil pressure switch was found to be satisfactory. The calibration check of the speed switch determined that it had no output on the low speed trip, high speed trip or tachometer drive. This indicated a failure of the speed switch. Failure of the speed switch was further confirmed by the absence of the Diesel Generator 2B At Speed on the Alarm Messages Report from the process computer. This data point comes in when the speed switch provides a permissive to close the generator output breaker at an engine speed of 810 RPM. The data point not coming in was consistent with the calibration check results.
The speed switch was removed and sent to Exelon Power Labs for evaluation. Power Labs testing determined that the speed switch did not respond to any input signal.
Power Labs tested individual components on the input sensing board and determined that an integrated circuit card had failed subcomponents. The board showed no visible evidence of damage, cracking, or deformation that would be associated with overheating. At the end of the inspection, Exelon staff were conducting a root cause evaluation to identify the causes of the integrated circuit card failure.
The team concluded that the failure of the 2B diesel generator to power 4.16 kV Bus 24 was due to the failure of the electronic speed switch. The team further concluded that the other ESSB-2AT electronic speed switches on the other EDGs functioned as designed during the event. The inspectors noted that the primary excessive engine start protection is provided by the electronic speed switch during emergency and non-emergency starts. The inspectors reviewed previous monitored start of the 2B EDG, and determined that the electronic speed switch actuates to interrupt the start failure relay in approximately 3 seconds. The inspectors noted that the oil pressure switch, monitoring engine bearing oil pressure, provides excessive start protection during only the prelube engine start. The team determined that the bearing lubricating oil pressure switch actuates at approximately 13 seconds during an emergency (non-prelube) start and at approximately 7 seconds during non-emergency prelube start.
Failure of the 2A Sequencer to perform its safety function
a. Inspection Scope
The team reviewed printouts of the sequence of events recorder and alarm recorder, and post-trip review packages to determine whether the shutdown sequencer appropriately started designated loads. The team also reviewed maintenance, testing, and calibration records to determine when the shutdown sequencer was last tested satisfactorily, whether maintenance activities had been completed as scheduled, and whether any maintenance performed in the interim would have adversely impacted the sequencers functioning.
b. Findings
No findings were identified.
In response to the signals from the TUR, 4.16 kV Bus 21 separated from offsite power and the 2A diesel generator received a start signal. The engine started and the generator output breaker closed, re-energizing the bus. However, several loads controlled by the shutdown sequencer (notably the 21 salt water pump and 21 instrument air compressor) did not start as expected. Operators subsequently manually started the 21 salt water pump and the salt water air compressors (backup to instrument air).
The team determined that the 2A shutdown sequencer function was last successfully tested on July 25, 2015. The shutdown sequencer was last replaced on February 27, 2013. There were no failures noted during the last four performance tests, and the team noted that a license amendment was approved by the NRC on October 21, 2014, to extend performance testing of the sequencer to 24 months (ML14280A522).
Troubleshooting of the 21 salt water pump controls found them to be functioning correctly. The 21 4.16 kV Bus Shutdown Sequencer was tested, and failed the test when no steps occurred after Step 0. Exelon staff replaced the failed sequencer and satisfactory tested the new sequencer for both Shutdown and LOCI Sequencer function.
The failed load sequencer was sent to the vendor for testing and evaluation. The vendor performed a failure analysis on the sequencer module. During testing, the LOCI sequencer portion of the module functioned as designed. The shutdown sequencer portion of the module exhibited intermittent failures to initiate Steps 1, 2, and 3.
Troubleshooting traced the failure to an integrated circuit which initiates Step 1. Since Step 1 did not occur, the timers for subsequent steps were not started.
The team concluded that the failure of the 2A Shutdown Sequencer to perform its intended function was due to a component failure. The team further concluded that the other diesel sequencers functioned as designed during the event.
2.3 Review of Operating Experience
a. Inspection Scope
The team reviewed and evaluated Exelons application of pertinent industry and internal operating experience and evaluation of potential precursors including the adequacy of actions taken in response to the operating experience or precursors. Specifically, the team reviewed both internal and external operating experience involving EDG and sequencer failures reviewed by the Exelon staff to identify and address these types of failures. In addition, the team examined the specific issues associated with EDG speed switch and the sequencer module failures to assess any new generic issues for prompt communication and dissemination.
b. Findings and Observations
No findings were identified.
2.4 Review of Operability and Reportability
a. Inspection Scope
The team reviewed Exelons staff evaluations of conditions surrounding the issue for reportability to verify Exelon met the proper reporting requirements of 10 CFR 50.72.
Additionally, the team reviewed the adequacy of Exelons assessments of operability with regards to the SW and EDG systems.
b. Findings and Observations
No findings were identified.
10 CFR 50.72 Exelon staff notified the NRC of a dual unit trip on April 7, 2015 (EN 50961) at 15:45 for an unplanned event that resulted in actuation of the reactor protection system (RPS)when the reactor was critical. Exelon staff also made an update to the original 50.72 notification to the NRC on April 9, 2015. This update identified that during post trip review, Exelon staff determined that the 21 salt water pump had to be manually started.
With the failure of the 2B EDG to load, there were no salt water pumps running for approximately 12 minutes. Additional troubleshooting determined the 2A EDG sequencer did not automatically start the 21 salt water pump. The loss of salt water pump and emergency diesel generator is reportable as an event that could have prevented fulfillment of a safety function and is also an unanalyzed condition.
The requirement to notify the NRC for an event that could have prevented fulfillment of a safety function and/or is an unanalyzed condition is an 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> report. The update to the original 50.72 was approximately 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after the event occurred. The inspectors concluded that, based on control room indications and plant logs, Exelon staff had prior opportunity to reasonably identify and report the loss of salt water cooling to the NRC.
This late reporting incident was evaluated against the examples for traditional enforcement in the NRC Enforcement Manual (ML102630150) and was determined to be of minor significance.
Operability Exelons staff identified as part of the post trip review that the crew did not make technical specification (TS) entries for the salt water pump and 2A EDG. As part of the post trip review late entries (4/10) were made documenting TS Action Statement 3.0.3 entry for loss of both salt water trains and 3.8.1.I for loss of both EDGs. Technical Specification 3.8.1.I requires to restore one EDG within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. Technical Specification 3.8.1.J (late entry) requires to be in mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. Operators returned the 2B EDG to service at 29 hours3.356481e-4 days <br />0.00806 hours <br />4.794974e-5 weeks <br />1.10345e-5 months <br />, so there was not a violation of the TS, notwithstanding the late log entry for this condition.
Additionally, the team noted that the operations crew did not enter TS 3.8.9 for the loss of 24 vital bus. This is a 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> completion time to restore to operable status. The 24 bus was reenergized at 20 minutes by offsite power. Therefore a violation of TS did not occur, notwithstanding this missed log entry.
3. Event Diagnosis and Crew Performance
a. Inspection Scope
To evaluate whether the operators performed in accordance with procedures and training, the team interviewed part of the Unit 2 operations crew that was on shift in the control room during the April 7, 2015, dual unit trip including: two senior reactor operators - the shift manager (SM), the Unit 2 control room supervisor (CRS), and one reactor operator (RO) assigned to Unit 2. The team also reviewed narrative logs; post-trip reviews (PTR), action reports (AR), plant computer trend data, alarm logs, and procedures implemented by the crew.
b. Findings and Observations
No findings were identified.
Unit 1:
The operators responded properly to the loss of power to the 4 kV vital busses and the subsequent turbine/reactor trip. Following the reactor trip, operators entered Emergency Operating Procedure (EOP) - 0, Post Trip Immediate Action (EOP-0) and completed all required actions, then transitioned to EOP-1, Reactor Trip (EOP-1). The main feed was loss due to the temporary loss of 1Y09 and 1Y10. The operators appropriately started the 13 AFW pump in accordance with EOP-0.
Unit 2:
The operators responded properly to the loss of power to the 4 kV vital busses and the subsequent turbine/reactor trip. Following the reactor trip, operators entered Emergency Operating Procedure - 0, Post Trip Immediate Action (EOP-0) and completed all required actions, then transitioned to EOP-1, Reactor Trip (EOP-1). The main feed was lost due to the temporary loss of 2Y09 and 2Y10. The 23 AFW pump did not start due to the loss of the 4 kV bus 24. The AFAS automatically actuated per design and started the 21 AFW pump.
The SM considered whether the offsite power was operable due to the voltage transient on the grid and contacted the transmission system operator prior to energizing the 24 bus with offsite power. Since offsite power was not lost to the non-vital 4 kV busses the reactor coolant pumps remained in operation and the main condenser functioned as the normal heat sink. As part of the diagnosis section of EOP-0, the crew did not enter EOP-2, Loss of Offsite Power/Loss of Forced Circulation (EOP-2) because the entry conditions were not met.
The operators followed the guidance in EOP-0 to start the 0C EDG as a contingency to power 24 bus. Approximately 20 minutes into the event the crew restored 24 bus utilizing offsite power. Also during EOP-0 they identified that 21 salt water pump was not running. Operators immediately started the pump to restore salt water cooling to the component cooling water and service water heat exchangers. The inspectors reviewed the operator response to the loss of salt water cooling, and determined that the response was in accordance with the EOPs and the design analysis. Specifically, the inspectors reviewed calculations that supported EDG operation without ultimate heat sink of salt water for approximately 38 minutes. Additionally, no salt water or service water high temperature alarm was received during the event.
4. Effectiveness of Licensees Response
a. Inspection Scope
The team reviewed and assessed the effectiveness of Exelons overall response to this event. The team interviewed plant personnel involved in the management and review of the event. The team also reviewed condition reports (CR) generated, completed PTRs, Initial Plant Transient Response Team (IPTRT) actions, Operational Decision Making Instruction (ODMI) checklists, complex troubleshooting plans and Operability Determinations (OD). The IPTRTs included initial failure analyses developed for the equipment challenges and interim corrective actions. The team reviewed NRC and Exelon generated operating experience searches to evaluate whether there were any potential precursors for which Exelon should have taken action to prevent the dual-unit trip.
b. Findings and Observations
No findings were identified.
5. Risk Significance of the Event
a. Initial Risk Assessment The initial risk assessment for this event is documented in the enclosed SIT charter (Attachment 1).
b. Final Risk Assessment The Region I Senior Reactor Analyst (SRA) performed a refined risk estimate of the conditional core damage probability (CCDP) for each unit based on the information gathered by the team. The CCNPP Unit 1 and Unit 2 Standardized Plant Analysis Risk (SPAR) Models were used to model the electrical grid disturbance event and equipment performance. The resulting CCDP for both Units was in the low to very low E-6 per year range.
Unit 1:
The SPAR Events and Conditions Assessment tool was used to model the conditions and equipment response for Unit 1. The final event CCDP was in the very low E-6 range. The grid disturbance transient resulted in the two 4 kV safety busses, 11 and 14, de-energizing when their offsite power sources separated due to the voltage drop in accordance with the TUR design scheme. This resulted in a turbine trip and reactor trip with a loss of main feedwater due to the momentary loss of power to the safety busses.
The temporary loss of offsite power to the safety buses was modeled by failing their offsite power feeder breakers open and then applying a recovery probability, in accordance with SPAR H Model calculations to reflect the actual recovery availability of offsite power consistent with the event conditions. Main Feedwater was modeled as lost concurrent with the loss of power to the busses. The dominant core damage sequence was a transient with the reactor trip circuit breakers failing to open and the Primary Power Operated Relief Valves (PORV) or safety relief valves (SRV) failing to reclose after passing liquid through them.
Unit 2:
The SPAR Model change set method was used to reflect the Unit 2 equipment response to the initiating event. The final CCDP was in the low E-6 range. Similar assumptions made for Unit 1 were made for the 4 kV safety busses 21 and 24 due to the grid disturbance and offsite power voltage drop. The safety bus TURs resulted in the loss of offsite power to the busses with a subsequent turbine trip and reactor trip and loss of main feedwater. Modeling assumptions included the failure of the 2B EDG to start and close its output breaker. An adjustment for offsite power recovery capability to the safety busses, using the SPAR H model calculation was performed. Main Feedwater was modeled as lost concurrent with the loss of power to the busses. Additional modeling assumptions included the initial loss of the 21 salt service water pump and 21 instrument air compressor due to the failure of the 21 4 kV bus shutdown sequencer, and the loss of the 22 salt water pump and 22 instrument air compressor given the failure of the 2B EDG to re-energize the 24 4 kV bus. The dominant core damage sequence was a transient with the reactor trip circuit breakers failing to open and the PORV or SRVs failing to reclose after passing liquid through them.
6. Exit Meetings
On April 17, 2015, the team presented their overall assessment and observations to members of Exelons management led by Mr. M. Flaherty, Plant Manager (Acting Site Vice President), and other members of his staff. The inspectors confirmed that any proprietary information reviewed during the inspection period was returned to Exelon staff.
Special Inspection Team Charter Calvert Cliffs Nuclear Power Plant Unit 1 and Unit 2 Dual Reactor Trips due to Grid Disturbance April 7, 2015 Background:
At 12:39 p.m. on April 7, 2015, a significant grid disturbance occurred due to the failure of a transmission line in Southern Maryland. The grid disturbance affected Calvert Cliffs primarily via offsite power line 5072, but both 500 kV offsite power sources saw an approximately 11 percent dip in grid voltage from 525 kV to 465 kV. This voltage dip was sensed on 4 kV Emergency Busses 11 and 14 (Unit 1) and Busses 21 and 24 (Unit 2). All four emergency bus feeder breakers tripped open as a result of Transient Undervoltage Relay (TUR) actuations, de-energizing all four emergency busses, causing all four emergency diesel generators (EDG)to autostart. The electrical perturbation also resulted in turbine trips on both units due to loss of the main generator exciter power supply on Unit 1 and loss of power to the turbine electrohydraulic control cabinet on Unit 2. The turbine trips resulted in reactor trips for both units.
The 2B EDG started but tripped 11 seconds later due to an apparent failure of the speed sensing relay. The 2B EDG had previously failed to start following the 2010 loss of power event due to a failure of the starting/sync circuit (Low Lube Oil pressure). The associated 24 emergency bus was de-energized for approximately 20 minutes until it was restored from offsite power.
The 21 salt water pump (powered from the 21 emergency bus) failed to automatically restart as designed when power to the bus was restored. Subsequently, the pump was manually started from the control room per procedure. Additionally, the 22 and 23 salt water pumps did not start because they were aligned to the 24 bus which was deenergized due to the failure of the 2B EDG. These two failures resulted in the complete loss of salt water flow for Unit 2 for approximately 12 minutes following the trip. On April 9, 2015, Exelon reported the temporary loss of salt water system as an event that could have prevented the fulfillment of a safety function.
The non-vital busses were less impacted by the electrical transient and all of the reactor coolant pumps continued to operate. Four of twelve circulating water pumps tripped on undervoltage; however, sufficient circulating water flow remained to maintain condenser vacuum and the normal heat sink for reactor decay heat removal for both units.
Basis for the Formation of the Special Inspection Team:
Brief Description of the Basis for the Assessment:
The Inspection Manual Chapter (IMC) 0309 review concluded that two of the deterministic criteria in Enclosure 1 of IMC 0309 were met. The first criterion met was for the repetitive failure of the 2B EDG to start and load during actual loss of power events in 2010 and 2015. The second criterion met was for multiple failures in systems used to mitigate an actual event, as all salt water cooling flow was lost for 12 minutes until control room operators manually started the 21 salt water pump.
Using the Calvert Cliffs Unit 1 and 2 Standardized Plant Analysis Risk (SPAR) models, a Region I Senior Reactor Analyst (SRA) conducted separate event assessments for each unit based upon best available information. For Unit 1, the electrical grid disturbance resulted in the 4 kV Emergency Busses 11 and 14 separating from their offsite source with power restored by the respective EDG. The voltage transient caused a turbine trip due to the main generator exciter power supply loss. A reactor trip occurred as the result of the turbine trip, the main condenser was maintained as a heat sink, and all safety systems responded as expected. The estimated conditional core damage probability (CCDP) for Unit 1 was in the low E-6 range. For Unit 2, the offsite voltage disturbance resulted in the 4 kV Emergency Busses 21 and 24 separating from their offsite source. The 2A EDG re-energized the 21 Bus, however the 2B EDG failed to power the 24 Bus. The loss of offsite power to the busses resulted in a Unit 2 turbine trip due to loss of power to the turbine control logic, and subsequent reactor trip. The 21 salt water pump failed to automatically restart when the 21 bus was re-energized by the EDG, but was manually started 12 minutes later by the operators. The main condenser was maintained as a heat sink. The estimated CCDP for Unit 2 was also in the low E-6 range.
The momentary loss of offsite power sources to both safety busses for each unit was modeled by revising the failure probability of the 4 kV offsite power feeder breakers to the safety busses to be 1E-2 from the nominal value of 3.6E-6. This was performed to model that offsite power could be recovered as a source to the safety bus if required. For Unit 2, the operators were capable of restoring power to the 24 bus after the failure of the 2B EDG by re-energizing the bus from the offsite power source. The dominant sequences for both units were the transient event with failure of pressurizer safety relief valves or power-operated relief valves to reclose with failure of the reactor to trip.
Based upon satisfying the deterministic criteria and the estimated CCDP values for both Unit 1 and Unit 2 being in the low E-6 range per the SPAR models (and comparable to the licensees CCDP estimates), the reactive inspection response is within the No Additional Inspection to Special Inspection overlap range for both units. A SIT is being initiated to gather information available from the event and to verify that immediate corrective actions were appropriate.
Objectives of the Special Inspection:
The SIT will review Exelons organizational and operator response to the event, equipment deficiencies, and the causes for the event and subsequent issues. The team will collect data, as necessary, to refine the existing risk analysis. Additionally, the team leader will review lessons learned identified during this special inspection and, if appropriate, prepare a feedback form on recommendations for revising the Reactor Oversight Process baseline inspection procedures.
To accomplish these objectives, the team will:
1. Develop a complete sequence of events including follow-up actions taken by Exelon.
2. Review and assess the equipment response to the event. This assessment should include an evaluation of the consistency of the equipment response with the plants design and regulatory requirements, and potential design deficiencies. In addition, review and assess the adequacy of any operability assessments, extent of condition reviews, digital control system response, corrective and preventive maintenance, and post-maintenance testing.
3. Review and assess operator performance, including review of procedures, logs, communications (internal and external), and emergency plan implementation.
4. Review and assess the effectiveness of Exelons response to this event. This includes overall organizational response, failure modes and effect analysis developed for the equipment challenges, and interim and proposed longer term corrective actions. Assess any weaknesses noted in safety culture. Root cause and other analyses related to this event not available at the time the inspectors are onsite are outside of the scope of this inspection.
5. Evaluate Exelons application of pertinent industry operating experience and evaluation of potential precursors, including the effectiveness of any actions taken in response to the operating experience or precursors; and 6. Collect any data necessary to refine the existing risk analysis and document the final risk analysis in the SIT report.
Guidance:
Inspection Procedure 93812, Special Inspection, provides additional guidance to be used by the SIT. Team duties will be as described in Inspection Procedure 93812. The inspection should emphasize fact-finding in its review of the circumstances surrounding the event. It is not the responsibility of the team to examine the regulatory process. Safety concerns identified that are not directly related to the event should be reported to the Region I office for appropriate action.
The Team will conduct an entrance meeting and begin the inspection on April 13, 2015. While on site, the Team Leader will provide daily briefings to Region I management, who will coordinate with the Office of Nuclear Reactor Regulation to ensure that all other parties are kept informed. A report documenting the results of the inspection will be issued within 45 days following the final exit meeting for the inspection.
This Charter may be modified should the team develop significant new information that warrants review.
DETAILED SEQUENCE OF EVENTS April 7, 2015 Dual Unit Trip with Equipment Issues The sequence of events was constructed by the team from review of Control Room Narrative Logs, corrective action program condition reports, post transient review report, process plant computer (PPC) data (alarm message file and plant parameter graphs) and plant personnel interviews. The sequence of events is listed separately by Unit 1 and Unit 2.
UNIT 1 EVENT TIMELINE Clock Time Description 04/07/2015 Red/Black 500 kV Bus Significant Voltage Drop (452.13 12:39:31 kV/453.39 kV)12:39:39.201 4 kV Bus 14 Under Voltage ESFAS Actuation 12:39:39.204 4 kV Bus 11 Under Voltage ESFAS Actuation 500 kV Breaker 22 Opened - Generator Trip (Loss of field resulted in the opening of the main generator 12:39:39.420 breaker and tripping of the main transformer)12:39:39.421 500 kV Breaker 23 Opened 12:40 Implemented EOP-0 for Reactor Trip Alternate action for Feed - initiated AFW. Started 13 12:45 AFW pump due to loss of Main Feed.
12:45 No EAL Call Determination 13:03 Exited EOP-0 13:03 Implemented EOP-1 13:07 Charging System Shutdown per OI-2A 13:30 Started Charging and Letdown per OI-2A 15:58 Bus 11 Normal Feeder Breaker 152-1115 Closed Diesel Generator 1A output breaker opened and secured 16:16 EDG.
Exited EOP-1 and transitioned to OP-4, Plant Shutdown 16:30 from Power Operations 16:43 Diesel Generator 1B output breaker opened 16:46 Diesel Generator 1B secured.
04/09/2015 06:32 Unit 1 Synched to the Grid UNIT 2 EVENT TIMELINE Clock Time Description 04/07/2015 Red/Black 500 kV Bus Significant Voltage Drop (452.13 12:39:31 kV/453.39 kV)12:39:39.195 4 kV Bus 24 Under Voltage ESFAS Actuation 12:39:39.204 4 kV Bus 21 Under Voltage ESFAS Actuation 12:39:39.209 Diesel Generator 2B Start Signal 12:39:39.265 Bus 24 Feeder Breaker 152-2401 Opened 12:39:39.279 Bus 21 Feeder Breaker 152-2101 Opened 12:39:39.473 Auto Stop Trip Solenoid Trip 12:39:45.632 Diesel Generator 2A At Speed 12:39:47.021 Diesel Generator 2A Output Breaker 152-2103 closed 12:39:50.884 Diesel Generator 2B Trip 12:40 Implemented EOP-0 for Reactor Trip Alternate Action for Reactivity - Borated due to loss of power 12:41 effects.
12:47 2Y10 was aligned to 2Y09 12:52 21 SW Pump was started 12:59:57.420 Bus 24 Feeder Breaker 152-2414 Closed 13:00 Bus 24 recovered from offsite-power via alternate feed 22 SW pump was started as a result of manual sequencer 13:00 initiation 13:25 Implemented AOP-7D for loss of Instrument Air 13:30 Started Charging and Letdown 13:33 AOP- 7D was Exited Exited EOP 1 and transitioned to OP-4, Plant Shutdown from 16:30 Power Operations 04/08/2015 03:00 2-AFW-4511 (Stm. Train Flow Control to 21 S/G) failed shut 03:00 T.S. Entry for 3.6.3.c CV failed shut 17:30 Diesel Generator 2B Declared Operable 22:46 Diesel Generator 2A Declared Inoperable 04/09/2015 ENS Notification for Unanalyzed Conditions related to complete 03:36 loss of SW flow for 12 mins.
03:57 2-AFW-4511 was returned to service T.S. 3.6.3.c Exited 04:33 PMT on New ESFAS STP 0-8A.2 (SAT)
UNIT 2 EVENT TIMELINE Clock Time Description 04:33 Declared Diesel Generator 2A Operable 06:14 Commence Pulling Rods 14:32 Unit 2 synched to the Grid
SUPPLEMENTAL INFORMATION
KEY POINTS OF CONTACT
Licensee Personnel
- M. Fick, Licensing Principal Regulatory Engineer
- M. Flaherty, Plant Manager
- J. Gains, Manager, Operations Senior Manager Operations Support
- E. Kreahling, Senior Engineer
- B. Kreger, Senior Regulatory Specialist
- D. Lauver, Director, LicensingSenior Engineering Manager, Design
- S. Loper, Senior Staff Systems Engineering
- E. Lyson, Shift Manager
- K. Robinson, Director Site Engineering
- L. Smith, Manager Site Regulatory Assurance
- B. Stark, Senior Design Engineering
- M. Taubert, Reactor Operator
- T. Tierney, Director Site Operations